UBUNTU-CVE-2026-88823: Medium severity ubuntu/openssl vulnerability
Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment. Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message. CWE: CWE-325: Missing Cryptographic Step Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message. The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD. FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to the AAD-authentication failure?
Applications using AES-GCM-SIV that supply Additional Authenticated Data in multiple updates are exposed if any update has zero length. A zero-length update causes AAD supplied before it to be omitted from authentication.
What must an attacker be able to do to exploit the issue?
The attacker must be able to forge or alter AAD for messages produced or accepted by an affected application flow. The vulnerability allows modification of AAD that the application intended to authenticate but that was supplied before an empty AAD fragment.
Are FIPS deployments affected?
No. The FIPS modules are not affected because AES-GCM-SIV is not available in FIPS mode.
Is there a separate risk when cryptographic contexts are reused?
Yes. Before the fix, reinitializing a context with a key or nonce did not clear accumulated AAD, so AAD from a prior use could be included with a new message. The fix clears accumulated AAD on reinitialization with a key or nonce.